doxygen/html/lixmm_8h_source.html

 /*
  * Copyright (c) 2020 Bitdefender
  * SPDX-License-Identifier: Apache-2.0
  */
 #ifndef _LIXMM_H_
 #define _LIXMM_H_

 #include "lixprocess.h"


 typedef struct _LIX_VMA
 {
     LIST_ENTRY      Link;
     QWORD           Gva;

     QWORD           Start;
     QWORD           End;

     QWORD           File;

     QWORD           Flags;

     LIX_TASK_OBJECT *Process;

     void            *Hook;
 } LIX_VMA, *PLIX_VMA;


 INTSTATUS
 IntLixMmGetInitMm(
     _Out_ QWORD *InitMm
     );

 INTSTATUS
 IntLixMmFindVmaRange(
     _In_ QWORD Gva,
     _In_ LIX_TASK_OBJECT *Task,
     _Out_ QWORD *VmaStart,
     _Out_ QWORD *VmaEnd
     );

 INTSTATUS
 IntLixMmFetchVma(
     _In_ LIX_TASK_OBJECT *Task,
     _In_ QWORD Address,
     _Out_ LIX_VMA *Vma
     );

 LIX_VMA *
 IntLixMmFindVma(
     _In_ LIX_TASK_OBJECT *Task,
     _In_ QWORD Vma
     );

 LIX_VMA *
 IntLixMmFindVmaByRange(
     _In_ const LIX_TASK_OBJECT *Process,
     _In_ QWORD Address
     );

 INTSTATUS
 IntLixMmPopulateVmas(
     _In_ LIX_TASK_OBJECT *Task
     );

 void
 IntLixMmDestroyVmas(
     _In_ LIX_TASK_OBJECT *Task
     );

 void
 IntLixMmListVmas(
     _In_ QWORD Mm,
     _In_ LIX_TASK_OBJECT *Process
     );

 INTSTATUS
 IntLixVmaInsert(
     _In_ void *Detour
     );

 INTSTATUS
 IntLixVmaChangeProtection(
     _In_ void *Detour
     );

 INTSTATUS
 IntLixVmaAdjust(
     _In_ void *Detour
     );

 INTSTATUS
 IntLixVmaExpandDownwards(
     _In_ void *Detour
     );

 INTSTATUS
 IntLixVmaRemove(
     _In_ void *Detour
     );

 #endif // _LIXMM_H_
_Out_
#define _Out_
Definition: intro_sal.h:22

IntLixMmGetInitMm
INTSTATUS IntLixMmGetInitMm(QWORD *InitMm)
Find the address of the "init_mm" variable inside the kernel.
Definition: lixmm.c:76

IntLixVmaAdjust
INTSTATUS IntLixVmaAdjust(void *Detour)
Detour handler for in-guest functions adjusting VMA ranges.
Definition: lixmm.c:2052

IntLixMmFindVmaRange
INTSTATUS IntLixMmFindVmaRange(QWORD Gva, LIX_TASK_OBJECT *Task, QWORD *VmaStart, QWORD *VmaEnd)
Finds the VMA limits that contain an address.
Definition: lixmm.c:640

_In_
#define _In_
Definition: intro_sal.h:21

INTSTATUS
int INTSTATUS
The status data type.
Definition: introstatus.h:24

IntLixVmaRemove
INTSTATUS IntLixVmaRemove(void *Detour)
Detour handler for functions that unmap memory for processes.
Definition: lixmm.c:2111

IntLixMmDestroyVmas
void IntLixMmDestroyVmas(LIX_TASK_OBJECT *Task)
Remove protection for the VMAs belonging to a process.
Definition: lixmm.c:1016

IntLixVmaInsert
INTSTATUS IntLixVmaInsert(void *Detour)
Detour handler for "__vma_link_rb" function.
Definition: lixmm.c:1692

_LIX_VMA::Start
QWORD Start
Start of the memory described by the VMA.
Definition: lixmm.h:19

IntLixVmaChangeProtection
INTSTATUS IntLixVmaChangeProtection(void *Detour)
Detour handler for "change_protection" function.
Definition: lixmm.c:1753

IntLixMmFindVmaByRange
LIX_VMA * IntLixMmFindVmaByRange(const LIX_TASK_OBJECT *Process, QWORD Address)
Finds if a memory address inside a process is being protected and returns the corresponding LIX_VMA s...
Definition: lixmm.c:699

IntLixMmFetchVma
INTSTATUS IntLixMmFetchVma(LIX_TASK_OBJECT *Task, QWORD Address, LIX_VMA *Vma)
Retrieve information about a VMA structure containing a user mode address.
Definition: lixmm.c:581

_LIX_VMA::End
QWORD End
End of the memory described by the VMA.
Definition: lixmm.h:20

QWORD
unsigned long long QWORD
Definition: intro_types.h:53

_LIX_TASK_OBJECT
Definition: lixprocess.h:38

_LIX_VMA::Hook
void * Hook
The EPT hook placed on the VMA when it is being protected.
Definition: lixmm.h:29

_LIX_VMA::Flags
QWORD Flags
Flags for the VMA.
Definition: lixmm.h:25

_LIX_VMA::Process
LIX_TASK_OBJECT * Process
Process owning the VMA.
Definition: lixmm.h:27

_LIX_VMA::Gva
QWORD Gva
The guest virtual address of the vm_area_struct this structure is based on.
Definition: lixmm.h:17

IntLixMmListVmas
void IntLixMmListVmas(QWORD Mm, LIX_TASK_OBJECT *Process)
Definition: lixmm.c:1671

lixprocess.h

_LIX_VMA
Definition: lixmm.h:14

IntLixMmPopulateVmas
INTSTATUS IntLixMmPopulateVmas(LIX_TASK_OBJECT *Task)
Populate the Introcore VMAs linked list by iterating the one inside the guest.
Definition: lixmm.c:1510

IntLixMmFindVma
LIX_VMA * IntLixMmFindVma(LIX_TASK_OBJECT *Task, QWORD Vma)
Finds a protected VMA inside a process VMA list.
Definition: lixmm.c:871

LIX_VMA
struct _LIX_VMA LIX_VMA

_LIX_VMA::Link
LIST_ENTRY Link
Linked list entry.
Definition: lixmm.h:16

IntLixVmaExpandDownwards
INTSTATUS IntLixVmaExpandDownwards(void *Detour)
Detour handler for "expand_downwards" function.
Definition: lixmm.c:1906

_LIST_ENTRY
Definition: introlists.h:16

_LIX_VMA::File
QWORD File
The Gva of the file this VMA maps to. Can be 0 which means this VMA is not a memory mapped file...
Definition: lixmm.h:23

PLIX_VMA
struct _LIX_VMA * PLIX_VMA